Add safe-deploy.sh: Python-based env parser, handles special chars in .env values safely. Remove legacy shell deploy scripts superseded by pipeline.

.woodpecker.yml

@@ -165,6 +165,7 @@ steps:
       - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
       - chmod 600 ~/.ssh/id_rsa
       - ssh-keyscan -H 192.168.4.32 >> ~/.ssh/known_hosts 2>/dev/null
+      - scp -o StrictHostKeyChecking=no deploy/safe-deploy.sh root@192.168.4.32:/tmp/sd.sh
       - |
         YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
         [ -z "$YAML_FILES" ] && echo "No yaml files changed" && exit 0
@@ -174,9 +175,7 @@ steps:
           rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
             "$f" root@192.168.4.32:/volume1/docker/compose-files/
           ssh -o StrictHostKeyChecking=no root@192.168.4.32 \
-            "cd /volume1/docker/compose-files \
-             && if [ -f ${STACK}.env ]; then set -a; . ./${STACK}.env; set +a; fi \
-             && docker stack deploy -c ${STACK}.yaml ${STACK}" \
+            "python3 /tmp/sd.sh ${STACK}" \
             && echo "  OK $STACK" || { echo "  FAIL $STACK"; exit 1; }
         done
     secrets: [ ssh_key ]